CVE-2025-12836
Stored XSS in VK Google Job Posting Manager Plugin Allows Script Injection
Publication date: 2026-01-24
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vk_google | job_posting_manager | to 1.2.20 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-12836 is a Stored Cross-Site Scripting (XSS) vulnerability in the VK Google Job Posting Manager WordPress plugin (versions up to and including 1.2.20). It occurs because the plugin does not properly sanitize and escape user input in the Job Description field. Authenticated users with author-level or higher permissions can inject malicious scripts into job posting pages. These scripts execute whenever any user views the affected page, potentially compromising site security.
How can this vulnerability impact me? :
This vulnerability allows attackers with author-level or higher access to inject arbitrary JavaScript into job posting pages. When other users visit these pages, the malicious scripts execute in their browsers, which can lead to session hijacking, defacement, theft of sensitive information, or further attacks on site visitors. It compromises the integrity and trustworthiness of the affected website.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying if the VK Google Job Posting Manager plugin version 1.2.20 or earlier is installed and active on your WordPress site. Since the vulnerability is a Stored Cross-Site Scripting via the Job Description field, you can check for suspicious script tags or injected JavaScript in job posting entries. Commands to detect the plugin version and suspicious content could include: 1) Using WP-CLI to check plugin version: `wp plugin get vk-google-job-posting-manager --field=version` 2) Searching the database for script tags in job description fields, e.g., using MySQL: `SELECT ID, post_content FROM wp_posts WHERE post_type = 'job_post' AND post_content LIKE '%<script>%'` or similar queries targeting the custom fields used by the plugin. Additionally, monitoring HTTP traffic for unexpected script execution or alerts from web application firewalls could help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Updating the VK Google Job Posting Manager plugin to a version later than 1.2.20 where the vulnerability is fixed. 2) Restricting author-level and above users from adding untrusted content in the Job Description field until the update is applied. 3) Applying additional input sanitization or output escaping measures if possible. 4) Reviewing and cleaning existing job postings for injected scripts. 5) Implementing web application firewall rules to block common XSS payloads targeting this plugin. 6) Monitoring logs for suspicious activity related to job posting pages. [1]